CVE-2026-81012

Received Received - Intake

Buffer Overflow in Linux Kernel hp-bioscfg Driver

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() hp_get_string_from_buffer() clamps the converted string length against the destination buffer size with "size > dst_size", so when the converted length is exactly equal to dst_size, conv_dst_size is left at dst_size and the unconditional NUL terminator write dst[conv_dst_size] = 0; lands one byte past the destination buffer. This is the same shape of bug as the previously fixed off-by-one in hp_convert_hexstr_to_str(): the buffer is sized correctly for the content, but the terminator write is never checked against that size. Fix by changing the comparison to ">=" so conv_dst_size is always left with room for the terminator. All fixed-size destinations that reach this function (path[512], current_value[512], current_password/current_value[64], and the per-entry buffers in encodings[][512] and prerequisites[][512]) are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-81012

EUVD

EUVD-2026-76335

Affected Vendors & Products

Vendor	Product	Version / Range
hp	hp_bioscfg	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the hp-bioscfg driver where a function incorrectly clamps string length checks, allowing a buffer overflow when writing a NUL terminator. The issue occurs when the converted string length equals the destination buffer size, causing the terminator to write one byte past the buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's hp-bioscfg module and requires checking for the affected function hp_get_string_from_buffer(). No direct network detection commands are available. System detection involves verifying the kernel version and checking if the vulnerable function exists in the hp-bioscfg module.

Impact Analysis

An attacker with local access could exploit this to corrupt kernel memory, potentially causing system crashes, privilege escalation, or arbitrary code execution. Systems using affected HP BIOS configuration tools are at risk.

Compliance Impact

This vulnerability is a buffer overflow issue in the Linux kernel's hp-bioscfg module. It does not directly relate to data privacy or security standards like GDPR or HIPAA, as it involves memory corruption in a BIOS configuration tool rather than unauthorized data access or exposure.

Mitigation Strategies

Apply the kernel patch that fixes the off-by-one write in hp_get_string_from_buffer(). Update the Linux kernel to a version containing the fix. If using a distribution kernel, check for and install available updates. For custom kernels, apply the upstream patch manually.

Hi! I’m here to help you understand CVE-2026-81012. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70